CROC interview question

How do you secure user's credentials during HTTP transfer?